zhaolei/MeshSate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 六引擎误报根因修复 — 解包递归、YARA 恒真规则、签名分级、real_type 溢出

Browse Source 
检测范围与证据链修复，不改裁决口径（口径改动在下一条提交）。

- extractor：zip/tar 成员在超限分支外漏加回扫描队列，解包后内容永远不参与检测；
  zip 目录条目被当成内嵌对象；tar 超限成员先落盘不删。递归真正生效后深扫耗时可测。
- clamav：_HIGH/_MEDIUM/_UNWANTED 关键词是小写，而签名名是 "Win.Trojan..." 大小写混排，
  分级判定恒不命中全走默认档；改统一大写匹配。超过 clamd MaxFileSize 的裸奔区间
  (1G~1.5G) 新增 ClamAVSkippedSizeLimit(30) — 按"不可扫描不放行"进复核。
- yara：pe.yar C1 系列改用导入表判定，不再靠裸子串命中字符串表；
  linux.yar C7 多条规则条件恒真（裸 nc/fetch 之类）已收紧；C8/C3 相应收窄。
- structure：DangerousExecutableExtension 是载体信号而非恶意行为，critical 权重 45→35，
  不再作为把中低置信度信号一起顶过 block_score 的底座。
- scanner/documents：real_type 拼进 libmagic 对 MSI/OLE 的元数据串实测 334+ 字符，
  超列宽导致整条 scan_tasks INSERT 连 findings 一起丢（被拒文件不留痕）→
  列宽 256→512，migrate.sql 补 ALTER。
This commit is contained in:
zhaolei
2026-11-02 20:26:56 +08:00
parent 64b682319e
commit b6a004bdb7
13 changed files with 636 additions and 311 deletions
Download Patch File Download Diff File Expand all files Collapse all files

174
app/engines/binary.py
View File

@@ -23,6 +23,32 @@ BINARY_EXTS = {".exe", ".dll", ".sys", ".scr", ".com", ".cpl", ".ocx", ".msi", "
_PE_SCN_MEM_EXECUTE = 0x20000000
_PE_SCN_MEM_WRITE = 0x80000000
# 声明扩展名 → 该格式自己的魔数。这些容器本就不是 PE，用 pefile 解析必然抛错；
# 把"格式完全正常的安装包/共享库"记成 PeParseFailed 会给每个 .msi/.jar/.so 白送 10 分。
_NATIVE_MAGIC: Dict[str, Any] = {
".msi": (b"\xd0\xcf\x11\xe0",),
".msp": (b"\xd0\xcf\x11\xe0",),
".mst": (b"\xd0\xcf\x11\xe0",),
".jar": (b"PK\x03\x04", b"PK\x05\x06"),
".war": (b"PK\x03\x04", b"PK\x05\x06"),
".apk": (b"PK\x03\x04", b"PK\x05\x06"),
".so": (b"\x7fELF",),
".elf": (b"\x7fELF",),
}
def _is_native_container(path: str, ext: str) -> bool:
"""文件内容是否就是其声明格式（非 PE）。"""
expected = _NATIVE_MAGIC.get(ext)
if not expected:
return False
try:
with open(path, "rb") as fh:
head = fh.read(4)
except OSError:
return False
return any(head.startswith(m) for m in expected)
def _manual_pe_analysis(path: str) -> List[Finding]:
"""pefile 解析失败时，手工搜索 PE\\0\\0 签名并解析节表。
@@ -172,6 +198,8 @@ class YaraEngine(Engine):
return result
try:
# 本环境的 yara-python 4.5.4 在 Match 对象上默认就带 meta，
# 且 rules.match() 不接受 with_meta 关键字（传了会整引擎报错）。
matches = rules.match(target.path)
except Exception as exc: # noqa: BLE001
result.ok = False
@@ -179,7 +207,8 @@ class YaraEngine(Engine):
return result
for match in matches:
severity, weight = _judge_yara_rule(match.rule, match.tags)
meta = getattr(match, "meta", None) or {}
severity, weight = _judge_yara_rule(match.rule, match.tags, meta)
# 覆盖：如果 ctx 里的策略为该 YARA 规则定义了精细权重，用它
try:
policy = ctx.policy_engine.policy
@@ -188,13 +217,18 @@ class YaraEngine(Engine):
weight = float(yara_weights[match.rule])
except Exception:
pass # ctx 没有 policy 字段时保持默认 weight
desc = str(meta.get("description", "")).strip()
tags_text = ", ".join(match.tags)
result.findings.append(
Finding(
engine=self.name,
layer=self.layer,
severity=severity,
rule=match.rule,
detail=f"YARA 规则 {match.rule} 命中（标签：{', '.join(match.tags) or '无'}）",
detail=(
f"YARA 规则 {match.rule} 命中"
+ (f"（{desc}）" if desc else f"（标签：{tags_text or '无'}）")
),
weight=weight,
meta={"tags": list(match.tags)},
)
@@ -232,6 +266,10 @@ class BinaryEngine(Engine):
if ext not in BINARY_EXTS:
return result
# 内容确实是声明的那个非 PE 容器（MSI=CFB、JAR/APK=ZIP、SO/ELF=ELF）→ 不做 PE 分析
if _is_native_container(target.path, ext):
return result
try:
import pefile
except Exception: # noqa: BLE001
@@ -290,17 +328,54 @@ class BinaryEngine(Engine):
)
)
# 2) 可疑导入表
suspicious_imports = self._suspicious_imports(pe)
if suspicious_imports:
# 2) 导入表能力信号：只做佐证，不做独立定罪
# Windows 自身的内核/外壳组件（kernel32、shell32、wer）必然导入
# VirtualAllocEx/WriteProcessMemory 这类 API——它们就是这些 API 的实现方。
# 真正的注入判定由 YARA C1_PE_ProcessInjection（导入名邻接窗口）负责，
# 这里按「命中个数」而不是「命中即高危」计分，避免正常软件被判恶意。
tier1, tier2, tier3 = self._suspicious_imports(pe)
if len(tier1) >= 2:
findings.append(
Finding(
engine=self.name,
layer=self.layer,
severity=Severity.HIGH.value,
rule="SuspiciousImports",
detail=f"导入表包含高危 API：{', '.join(suspicious_imports[:8])}",
weight=25.0,
detail=f"导入表同时包含多个注入/后门级 API：{', '.join(tier1[:8])}",
weight=20.0,
)
)
elif len(tier1) == 1:
findings.append(
Finding(
engine=self.name,
layer=self.layer,
severity=Severity.LOW.value,
rule="SuspiciousImports",
detail=f"导入表含单个注入/后门级 API（系统组件常态，需其他信号佐证）：{tier1[0]}",
weight=5.0,
)
)
if len(tier2) >= 3:
findings.append(
Finding(
engine=self.name,
layer=self.layer,
severity=Severity.LOW.value,
rule="CapabilityImports",
detail=f"导入表同时具备多项危险能力：{', '.join(tier2[:8])}",
weight=10.0,
)
)
elif tier3:
findings.append(
Finding(
engine=self.name,
layer=self.layer,
severity=Severity.INFO.value,
rule="AntiDebugImports",
detail=f"导入表含反调试/环境探测 API（正常软件普遍使用）：{', '.join(tier3[:8])}",
weight=0.0,
)
)
@@ -312,8 +387,8 @@ class BinaryEngine(Engine):
layer=self.layer,
severity=Severity.MEDIUM.value,
rule="UnsignedExecutable",
detail="可执行文件未携带数字签名",
weight=20.0,
detail="可执行文件未携带数字签名（内网自研工具常态，仅辅助人工判断）",
weight=10.0,
)
)
@@ -330,7 +405,7 @@ class BinaryEngine(Engine):
severity=Severity.LOW.value,
rule="SuspiciousTimestamp",
detail="PE 编译时间戳异常，可能被伪造",
weight=10.0,
weight=0.0,
)
)
except Exception: # noqa: BLE001
@@ -433,32 +508,62 @@ class BinaryEngine(Engine):
severity=Severity.LOW.value,
rule="DebugInformationPresent",
detail="PE 包含调试信息（PDB 路径或 .debug 节），可用于逆向定位",
weight=10.0,
weight=0.0,
)
)
return findings
def _suspicious_imports(self, pe: Any) -> List[str]:
"""检测高危 API 导入。"""
suspicious = {
def _suspicious_imports(self, pe: Any) -> "tuple[List[str], List[str], List[str]]":
"""导入 API 按恶意指向分档。
返回 (tier1, tier2, tier3)：
tier1 注入/后门级 API —— 单独出现即可疑
tier2 危险能力 API —— 正常软件也常用，需多项共存才计分
tier3 反调试/探测 API —— 信息项，不计分（大量合法商业软件带加壳自保会用）
"""
tier1_set = {
"VirtualAllocEx", "WriteProcessMemory", "CreateRemoteThread",
"NtUnmapViewOfSection", "SetWindowsHookEx", "OpenProcess",
"WinHttpOpen", "InternetOpenUrl", "URLDownloadToFile",
"CryptEncrypt", "AdjustTokenPrivileges", "CreateService",
"ShellExecute", "WinExec", "IsDebuggerPresent", "CheckRemoteDebuggerPresent",
"NtUnmapViewOfSection", "SetWindowsHookEx", "SetWindowsHookExA",
"SetWindowsHookExW", "URLDownloadToFileA", "URLDownloadToFileW",
"QueueUserAPC", "NtQueueApcThread", "RtlCreateUserThread",
}
found: List[str] = []
tier2_set = {
"OpenProcess", "WinHttpOpen", "WinHttpOpenRequest", "WinHttpSendRequest",
"CryptEncrypt", "CryptDeriveKey", "AdjustTokenPrivileges",
"LookupPrivilegeValueA", "LookupPrivilegeValueW", "OpenProcessToken",
"VirtualProtectEx", "ReadProcessMemory", "SuspendThread", "GetAsyncKeyState",
"SetWinEventHook", "HttpSendRequestA", "InternetWriteFile",
"RegSetValueExA", "RegSetValueExW",
# 以下 API 恶意软件常用，但任何"要装服务/要启动进程/要联网"的正常
# 软件都必然导入它们，不足以单独定罪
"WinExec", "ShellExecuteExA", "ShellExecuteExW", "CreateServiceA",
"CreateServiceW", "InternetOpenUrlA", "InternetOpenUrlW",
"CreateNamedPipeA", "DefineDosDeviceW",
}
tier3_set = {
"IsDebuggerPresent", "CheckRemoteDebuggerPresent", "OutputDebugStringA",
"GetTickCount", "GetTickCount64", "QueryPerformanceCounter",
"GetProcessHeap", "FindWindowA", "FindWindowW",
}
found1: List[str] = []
found2: List[str] = []
found3: List[str] = []
try:
for entry in getattr(pe, "DIRECTORY_ENTRY_IMPORT", []) or []:
for imp in entry.imports:
if imp.name:
name = imp.name.decode("utf-8", errors="replace")
if name in suspicious:
found.append(name)
if not imp.name:
continue
name = imp.name.decode("utf-8", errors="replace")
if name in tier1_set:
found1.append(name)
elif name in tier2_set:
found2.append(name)
elif name in tier3_set:
found3.append(name)
except Exception: # noqa: BLE001
pass
return sorted(set(found))
return sorted(set(found1)), sorted(set(found2)), sorted(set(found3))
def _has_signature(self, pe: Any) -> bool:
"""检查 PE 是否包含 Authenticode 签名目录。"""
@@ -469,8 +574,25 @@ class BinaryEngine(Engine):
return False
def _judge_yara_rule(rule: str, tags: List[str]) -> tuple[str, float]:
"""依据 YARA 规则名与标签判定严重度。"""
_YARA_RISK_SEVERITY = {
"critical": Severity.CRITICAL.value,
"high": Severity.HIGH.value,
"medium": Severity.MEDIUM.value,
"low": Severity.LOW.value,
}
_YARA_RISK_WEIGHT = {"critical": 85.0, "high": 60.0, "medium": 30.0, "low": 10.0}
def _judge_yara_rule(rule: str, tags: List[str], meta: Dict[str, Any] | None = None) -> tuple[str, float]:
"""依据规则 meta.risk_level 判定严重度（其次才是标签/规则名启发式）。
v0.2.3 只看标签与规则名，规则库里的 risk_level 被完全忽略，
结果 65 分的 C1_PE_RAT 显示成"低危"，权重与严重度两套口径。
"""
risk = str((meta or {}).get("risk_level", "")).strip().lower()
if risk in _YARA_RISK_SEVERITY:
return _YARA_RISK_SEVERITY[risk], _YARA_RISK_WEIGHT[risk]
tag_set = {t.lower() for t in tags}
text = f"{rule} {' '.join(tags)}".lower()

18
app/engines/clamav.py
View File

@@ -45,9 +45,21 @@ class ClamAVEngine(Engine):
except _ClamdSizeLimit:
# 文件超过 ClamAV MaxFileSize（clamd.conf 可调，默认 1G）
# → 引擎只是拒扫这个大文件，不当成引擎故障
# 但"没查过"必须留下信号：策略里 max_file_size 是 1.5G，1G~1.5G 的文件
# 原本在 L1 完全裸奔却仍可能 clean/pass。按"不可扫描不放行"落人工复核。
result.ok = True
result.meta["skipped"] = "size_limit"
result.meta["reason"] = "文件超过 ClamAV 大小限制已跳过"
result.findings.append(
Finding(
engine=self.name,
layer=self.layer,
severity=Severity.MEDIUM.value,
rule="ClamAVSkippedSizeLimit",
detail="文件超过 clamd MaxFileSize，L1 签名查杀未执行，按不可扫描内容处置",
weight=30.0,
)
)
return result
except Exception as exc: # noqa: BLE001
# 真·引擎不可用：连不上 / PING 超时 / daemon 挂了
@@ -267,9 +279,9 @@ def _parse_clamd_response(text: str) -> Dict[str, Any]:
# 签名名中的可信度关键词映射到严重度
_HIGH_KEYWORDS = ("ransom", "crypt", "trojan", "backdoor", "rootkit", "stealer", "keylog", "worm", "dropper", "ransomware")
_MEDIUM_KEYWORDS = ("generic", "heur", "packed", "obfusc", "suspect", "malware", "riskware", "virus")
_UNWANTED_KEYWORDS = ("PUA", "unwanted", "toolkit", "pup", "adware")
_HIGH_KEYWORDS = ("RANSOM", "CRYPT", "TROJAN", "BACKDOOR", "ROOTKIT", "STEALER", "KEYLOG", "WORM", "DROPPER")
_MEDIUM_KEYWORDS = ("GENERIC", "HEUR", "PACKED", "OBFUSC", "SUSPECT", "MALWARE", "RISKWARE", "VIRUS")
_UNWANTED_KEYWORDS = ("PUA", "UNWANTED", "TOOLKIT", "PUP", "ADWARE")
# EICAR 测试病毒签名 —— 明确标为 critical（等保要求：检测到即阻断）
_EICAR_SIGNATURES = ("Eicar-Test-Signature", "EICAR-AV-Test", "Eicar-Test-Signature.UNOFFICIAL")

54
app/engines/documents.py
View File

@@ -56,6 +56,19 @@ EML_EXTS = {".eml", ".msg"}
# 带 VBA 宏的 Office 扩展名（用于 VBA 纯文本扫描触发）
VBA_MACRO_OFFICE_EXTS = OLE_EXTS | OOXML_EXTS | {".bas", ".vba", ".cls", ".frm"}
# OOXML 包内的内嵌 OLE 部件目录
EMBED_PREFIX_RE = re.compile(r"^(?:word|xl|ppt)/embeddings/.+")
# 内嵌对象中的办公载体：文档互嵌（子表格/图表/PDF）是正常用法，不等于藏可执行
OFFICE_PART_EXTS = {
".docx", ".docm", ".xlsx", ".xlsm", ".pptx", ".pptm",
".doc", ".xls", ".ppt", ".pdf", ".rtf", ".xml", ".txt", ".csv",
".htm", ".html", ".wmf", ".emf", ".bin",
}
# 内嵌部件里直接判定为可执行对象的扩展名
EXEC_PART_EXTS = {".exe", ".dll", ".scr", ".js", ".jse", ".vbs", ".vbe", ".bat", ".cmd", ".ps1", ".hta", ".com", ".msi"}
# VBA 自动执行入口关键词
VBA_AUTOEXEC_PATTERNS = [
r"Sub\s+AutoOpen\s*\(", r"Sub\s+AutoExec\s*\(", r"Sub\s+AutoNew\s*\(",
@@ -211,14 +224,16 @@ class DocumentEngine(Engine):
else:
parser.close()
except Exception as exc: # noqa: BLE001
# 宏流解析不了 = 内容不可判定。这类畸形 OLE 常被用来探测解析器异常，
# 给 0 分等于"看不懂就放行"，落人工复核。
findings.append(
Finding(
engine=self.name,
layer=self.layer,
severity=Severity.LOW.value,
severity=Severity.MEDIUM.value,
rule="OleToolsUnavailable",
detail=f"VBA 宏解析失败：{exc}",
weight=0.0,
weight=30.0,
)
)
@@ -407,6 +422,24 @@ class DocumentEngine(Engine):
"excerpt": excerpt,
}
def _looks_like_executable(self, zf: Any, name: str) -> bool:
"""判断内嵌部件是否为可执行载荷（扩展名 + 文件头魔数）。
oleObject1.bin 之类的外壳里可能装着真正的 PE，光看扩展名会漏；
反之把每个 .bin 都判成可执行又会拦掉正常的图表/子文档。
"""
if os.path.splitext(name)[1].lower() in EXEC_PART_EXTS:
return True
try:
with zf.open(name) as fp:
head = fp.read(1 << 20)
except Exception: # noqa: BLE001
return False
if head[:2] == b"MZ" or head[:4] in (b"\x7fELF", b"\xca\xfe\xba\xbe"):
return True
# OLE 复合容器（Package/Ole10Native）内嵌 PE：找 MZ..PE 头
return bool(re.search(rb"MZ[\x00-\xff]{0,64}PE\x00\x00", head))
def _scan_ooxml(self, target: ScanTarget) -> List[Finding]:
"""检测 OOXML（docx/xlsx/pptx）中的外部引用与外部链接。"""
findings: List[Finding] = []
@@ -429,9 +462,11 @@ class DocumentEngine(Engine):
weight=45.0,
)
)
if name.startswith("word/embeddings/") or name.startswith("xl/embeddings/") or name.startswith("ppt/embeddings/"):
# 内嵌 OLE 部件。zip 目录条目（以 / 结尾、长度为 0）不是部件——
# PowerPoint 导出的包常带空的 ppt/embeddings/ 目录，按文件处理会凭空报内嵌对象。
if EMBED_PREFIX_RE.match(name) and not name.endswith("/"):
embedded_ext = os.path.splitext(name)[1].lower()
if embedded_ext in {".exe", ".dll", ".scr", ".js", ".vbs", ".bat", ".bin"}:
if self._looks_like_executable(zf, name):
findings.append(
Finding(
engine=self.name,
@@ -442,6 +477,17 @@ class DocumentEngine(Engine):
weight=75.0,
)
)
elif embedded_ext in OFFICE_PART_EXTS:
findings.append(
Finding(
engine=self.name,
layer=self.layer,
severity=Severity.LOW.value,
rule="EmbeddedObject",
detail=f"文档内嵌办公对象：{name}",
weight=5.0,
)
)
else:
findings.append(
Finding(

39
app/engines/extractor.py
View File

@@ -205,8 +205,9 @@ class SafeExtractor:
safe_name = self._sanitize_name(name)
dest = os.path.join(out_dir, safe_name)
try:
written = 0
overflow = False
with zf.open(info) as src, open(dest, "wb") as out:
written = 0
while True:
chunk = src.read(1024 * 1024)
if not chunk:
@@ -222,20 +223,22 @@ class SafeExtractor:
f"成员 {name} 实际解压超限，已丢弃",
10.0,
)
overflow = True
break
out.write(chunk)
else:
report.total_bytes += written
report.files.append(
ScanTarget(
path=dest,
filename=safe_name,
declared_ext=os.path.splitext(safe_name)[1].lower(),
logical_path=f"{target.logical_path}!/{name}",
depth=target.depth + 1,
is_extracted=True,
)
# 成员必须回到扫描队列，否则压缩包/OOXML 里的内容永远不参与检测
if not overflow:
report.total_bytes += written
report.files.append(
ScanTarget(
path=dest,
filename=safe_name,
declared_ext=os.path.splitext(safe_name)[1].lower(),
logical_path=f"{target.logical_path}!/{name}",
depth=target.depth + 1,
is_extracted=True,
)
)
except Exception as exc: # noqa: BLE001
self._add_finding(
report,
@@ -323,14 +326,26 @@ class SafeExtractor:
continue
with src, open(dest, "wb") as out:
written = 0
overflow = False
while True:
chunk = src.read(1024 * 1024)
if not chunk:
break
written += len(chunk)
if written > self.settings.max_upload_bytes:
out.close()
os.remove(dest)
self._add_finding(
report,
Severity.MEDIUM.value,
"MemberTooLarge",
f"成员 {name} 实际解压超限，已丢弃",
10.0,
)
overflow = True
break
out.write(chunk)
if not overflow:
report.total_bytes += written
report.files.append(
ScanTarget(

32
app/engines/keywords.py
View File

@@ -21,6 +21,9 @@ from app.engines.base import Engine, EngineResult, Finding, ScanTarget, Severity
logger = logging.getLogger(__name__)
# cross_line 规则用的续行归一：换行（及其两侧空白）压成一个空格
NEWLINE_RUN_RE = re.compile(r"\s*[\r\n]+\s*")
class KeywordEngine(Engine):
"""内网特征词表匹配引擎。"""
@@ -94,12 +97,13 @@ class KeywordEngine(Engine):
if not text:
return result
# ---- 预处理：合并换行符以支持跨行关键词 ----
# 攻击者会把 Invoke-WebRequest 这种关键字用 CRLF 拆成
# "Invoke-Web\r\nRequest" 来绕过基于单行的匹配。
# 这里把所有 \r\n / \r / \n 替换为空，让跨行关键词重新拼接。
# 注意：不影响纯文本/多行语义，我们匹配的都是单行关键词或跨行命令。
text = text.replace("\r\n", "").replace("\r", "").replace("\n", "")
# ---- 预处理 ----
# 默认按原始行匹配：把整篇文本的换行全部删除会让上一行行尾和下一行行首
# 黏成一句话（Ruby 源码 "…breed\n+fetch()…" 曾被当成 curl 特征命中）。
# cross_line: true 的规则再跑一遍"换行压成空格"的文本，用于兜住
# wget \ + 换行 + -O payload 这类续行绕过；保留分隔符，不产生黏连。
text_norm = text.replace("\r\n", "\n").replace("\r", "\n")
text_joined = NEWLINE_RUN_RE.sub(" ", text_norm)
for rule in self._compiled:
match_mode = rule.get("match", "contains")
@@ -113,23 +117,29 @@ class KeywordEngine(Engine):
if match_mode == "regex":
compiled = rule.get("_re")
if compiled:
for m in compiled.finditer(text):
snippet = text[max(0, m.start() - 10): m.end() + 10]
hits.append(snippet.strip())
scan_targets = [text_norm]
if rule.get("cross_line"):
scan_targets.append(text_joined)
for body in scan_targets:
for m in compiled.finditer(body):
snippet = body[max(0, m.start() - 10): m.end() + 10]
hits.append(" ".join(snippet.split()))
if len(hits) >= 3:
break
if len(hits) >= 3:
break
elif match_mode == "any_of":
keywords = rule.get("keywords", [])
for kw in keywords:
if kw.lower() in text.lower():
if kw.lower() in text_norm.lower():
hits.append(kw)
if len(hits) >= 3:
break
elif match_mode == "contains":
pattern = rule.get("pattern", "")
if pattern and (pattern.lower() in text.lower()):
if pattern and (pattern.lower() in text_norm.lower()):
hits.append(pattern)
if hits:

5
app/engines/structure.py
View File

@@ -108,6 +108,9 @@ class StructureEngine(Engine):
)
# 3) 危险可执行扩展名（顶层文件）
# 这是「载体」信号而不是恶意行为：单独命中应当进人工复核（≥review_score），
# 但不能成为把后续中/低置信度检测一起顶过 block_score 的底座，
# 否则正常签名的 exe/dll 会被判恶意。
if ext in DANGEROUS_EXTS and not target.is_extracted:
severity = Severity.CRITICAL.value if ext in {".exe", ".scr", ".dll", ".com", ".pif"} else Severity.HIGH.value
findings.append(
@@ -117,7 +120,7 @@ class StructureEngine(Engine):
severity=severity,
rule="DangerousExecutableExtension",
detail=f"文件类型为可执行/脚本格式：{ext}",
weight=45.0 if severity == Severity.CRITICAL.value else 30.0,
weight=35.0 if severity == Severity.CRITICAL.value else 30.0,
)
)

2
app/models.py
View File

@@ -52,7 +52,7 @@ class ScanTask(Base):
size: Mapped[int] = mapped_column(Integer, default=0)
sha256: Mapped[str] = mapped_column(String(64), index=True)
md5: Mapped[str] = mapped_column(String(32), default="")
real_type: Mapped[str] = mapped_column(String(256), default="")
real_type: Mapped[str] = mapped_column(String(512), default="")
status: Mapped[str] = mapped_column(String(16), default="pending", index=True)
mode: Mapped[str] = mapped_column(String(16), default="sync")

19
app/services/scanner.py
View File

@@ -34,6 +34,17 @@ _settings = get_settings()
TEMP_ROOT = os.environ.get("MESHSAFE_TEMP_ROOT", "/tmp/meshsafe")
def _clip(value: Any, limit: int) -> str:
"""按列宽截断字符串。
外部可控的长度（libmagic 描述串、归档成员路径、用户文件名）一旦超出列宽，
PostgreSQL 会拒绝整条 INSERT，连带同事务里的 scan_findings 一起丢失——
被拒绝的文件反而查不到记录。宁可截断，也不能整条不落库。
"""
text = str(value or "")
return text[:limit]
@dataclass
class ScanContext:
"""一次扫描任务的上下文。"""
@@ -95,12 +106,12 @@ class ScanOutcome:
id=self.task_id,
channel=self.channel,
client_id=self.client_id,
filename=self.file_info.get("filename", ""),
declared_ext=self.file_info.get("declared_ext", ""),
filename=_clip(self.file_info.get("filename", ""), 512),
declared_ext=_clip(self.file_info.get("declared_ext", ""), 32),
size=self.file_info.get("size", 0),
sha256=self.file_info.get("sha256", ""),
md5=self.file_info.get("md5", ""),
real_type=self.file_info.get("real_type", ""),
real_type=_clip(self.file_info.get("real_type", ""), 512),
status="completed",
mode=self.mode,
verdict=self.verdict,
@@ -122,7 +133,7 @@ class ScanOutcome:
severity=f.severity,
rule=f.rule,
detail=f.detail,
extracted_path=f.extracted_path,
extracted_path=_clip(f.extracted_path, 1024),
weight=f.weight,
))

91
rules/linux.yar
View File

@@ -117,17 +117,23 @@ rule C7_Linux_ReverseShell_Misc {
meta:
risk_level = "medium"
category = "C7"
false_positive_rate = "medium"
false_positive_rate = "low"
reference = "多种语言反弹 Shell 通用特征"
description = "通用反弹 Shell 标记：/dev/tcp 或 /dev/udp 或 reverse shell 工具名"
description = "通用反弹 Shell 标记：/dev/udp 或 攻击工具名 + shell 参数"
strings:
$devudp = /\/dev\/udp\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{2,5}/ ascii
$bashc = /bash\s+-c\s+['"].*\/dev\/(tcp|udp)/ ascii
$dash_e = /\/bin\/bash\s+-e\s+['"]/ ascii
$hydra = /Hydra|crackmap|weevely|meterpreter|msfconsole|msfvenom/ ascii nocase
// 裸词 Hydra 会命中 "dehydrated"、crack 会命中 "cracklib"，必须带参数或成组出现
$hydra = /\bhydra\s+(-l|-P|-p|-s|-m|-t)\b/ ascii nocase
$tool = /\b(crackmapexec|weevely|meterpreter|msfconsole|msfvenom)\b/ ascii nocase
$reverseshell = /reverse[_\s]?shell|shell[_\s]?shock/ ascii nocase
$netart = /(nc|ncat)\s+\S+\s+\d{2,5}\s+-[ec]\b|\/dev\/(tcp|udp)\/|socat\s+EXEC:|bash\s+-i\s*>&/ ascii
condition:
any of ($devudp, $bashc, $dash_e) or any of ($hydra, $reverseshell)
any of ($devudp, $bashc, $dash_e)
or $hydra
or ($tool and $netart)
or ($reverseshell and $netart)
}
@@ -177,40 +183,43 @@ rule C7_Linux_Persistence_SystemD {
meta:
risk_level = "high"
category = "C7"
false_positive_rate = "medium"
false_positive_rate = "low"
reference = "MITRE ATT&CK T1543.002 Systemd Service"
description = "恶意 systemd unit 文件：ExecStart 指向 /tmp/.hidden + multi-user.target + 反弹命令"
description = "恶意 systemd unit：ExecStart 指向临时目录隐藏文件 / 管道执行 / 反弹命令"
strings:
$unit = /\[Unit\]/ ascii
$service = /\[Service\]/ ascii
$install = /\[Install\]/ ascii
$execstart = /ExecStart=/ ascii
$multiuser = /multi-user\.target/ ascii
$hiddenpath = /\/tmp\/\.?\w+|\/var\/tmp\/\.?\w+/ ascii
$bashsh = /\/bin\/(ba)?sh\s+-c/ ascii
// 隐藏文件（点开头）落在可写临时目录——正常 unit 只会在 /usr/bin、/opt 等路径
$hiddenpath = /\/(tmp|var\/tmp|dev\/shm)\/\.[a-zA-Z0-9_-]{2,}/ ascii
$pipe = /(curl|wget)\s+\S+\s*\|\s*(ba)?sh/ ascii
$revshell = /((nc|ncat|socat)\s+.*(-e|--exec|EXEC:)\s*\/bin\/(ba)?sh|\/dev\/tcp\/\d{1,3}\.\d{1,3})/ ascii
condition:
// 完整 unit 片段 + 可疑路径
$unit and $service and $execstart and ($hiddenpath or $bashsh)
($unit and $service and $execstart and any of ($hiddenpath, $pipe, $revshell))
or
// Install multi-user.target + ExecStart 反弹
$install and $multiuser and any of ($execstart, $bashsh)
($install and $multiuser and $execstart and any of ($hiddenpath, $pipe, $revshell))
}
rule C7_Linux_Persistence_LD_PRELOAD {
meta:
risk_level = "high"
category = "C7"
false_positive_rate = "medium"
false_positive_rate = "low"
reference = "MITRE ATT&CK T1574.006 LD_PRELOAD"
description = "LD_PRELOAD 劫持：环境变量注入 + .so 文件 + dlopen"
description = "LD_PRELOAD 劫持：写 ld.so.preload 或预加载临时目录里的 .so"
strings:
$ldpreload = /LD_PRELOAD=/ ascii
$sofile = /\.so(\.\d+)?:?/ ascii
$dlopen = "dlopen" ascii
$dlsym = "dlsym" ascii
$exportenv = /export\s+LD_PRELOAD/ ascii
$ldso = /ld\.so\.preload/ ascii
$tmpso = /\/(tmp|var\/tmp|dev\/shm|proc\/\d+\/root)\/[a-zA-Z0-9_.\/-]*\.so(\.[0-9]+)?/ ascii
condition:
($ldpreload or $exportenv) and ($sofile or $dlopen or $dlsym)
// /etc/ld.so.preload 是内核级后门常用落点，单独出现即算证据
$ldso
or
// LD_PRELOAD 指向可写临时目录的 so；README 里 LD_PRELOAD=libasan.so 不算
(any of ($ldpreload, $exportenv) and $tmpso)
}
@@ -267,41 +276,55 @@ rule C7_Misc_Ruby_Lua_ReverseShell {
meta:
risk_level = "medium"
category = "C7"
false_positive_rate = "medium"
false_positive_rate = "low"
reference = "多语言反弹 Shell"
description = "Ruby/Lua 反弹 Shell：TCPSocket + exec/system"
description = "Ruby/Lua 反弹 Shell：Socket 对象 + 紧邻的 shell 执行调用"
strings:
$ruby = "TCPSocket" ascii
$ruby2 = "Socket.tcp" ascii
$lua = "loadstring" ascii
$lua2 = "luasocket" ascii
$exec = /(exec|system|IO\.popen)\s+.*\/bin\/(ba)?sh/ ascii
$exec = /(\bexec|\bsystem|IO\.popen|\bpopen|os\.execute|os\.runtime)\s*\(?\s*['"]((\/bin\/)?(ba)?sh|nc\s+-e|\/dev\/tcp)[^'"]{0,48}/ ascii
condition:
any of ($ruby, $lua, $lua2) and ($exec or any of ($ruby, $lua, $lua2))
// 只要出现 TCPSocket/loadstring 就命中 = 任何内嵌 Lua 的程序（Redis、nginx-lua、
// Wireshark 插件）必中。语言标记与 shell 执行必须挨在一起（256B 内）。
$exec and (
for any i in (1..#exec): (
any of ($ruby, $ruby2, $lua, $lua2) in (@exec[i] - 256..@exec[i] + 256)
)
)
}
// =============================================================================
// C7-5 网络投毒 / MITM 工具（内网横向移动）
// 工具名必须整词匹配，且与攻击参数成组出现
// =============================================================================
rule C7_Network_Tools_Malicious {
meta:
risk_level = "medium"
category = "C7"
false_positive_rate = "medium"
false_positive_rate = "low"
reference = "内网攻击工具"
description = "内网攻击工具：ettercap/responder/nmap 扫描 + SMB/DNS 投毒"
description = "内网攻击工具：ettercap/responder/nmap + 投毒参数成组出现"
strings:
$ettercap = "ettercap" ascii nocase
$responder = /responder(\.py)?/ ascii nocase
$nmap = "nmap" ascii nocase
$smb = /--smb/ ascii
$ms17 = "ms17-010" ascii nocase
$smbghost = "SMBGhost" ascii nocase
$dnsspoof = /dns[-_]spoof|dns[-_]mitm/ ascii nocase
$arppoison = /arp[-_]poison|arp[-_]spoof/ ascii nocase
$tool1 = /\bettercap\b/ ascii nocase
$tool2 = /\bresponder(\.py)?\b/ ascii nocase
$tool3 = /\bnmap\b/ ascii nocase
// 攻击参数 / 漏洞编号（这些才是意图证据）
$art1 = /--smb/ ascii
$art2 = /\bms17-010\b/ ascii nocase
$art3 = /\bSMBGhost\b/ ascii nocase
$art4 = /\bdns[-_]spoof\b|\bdns[-_]mitm\b/ ascii nocase
$art5 = /\barp[-_]poison\b|\barp[-_]spoof\b/ ascii nocase
$art6 = /--Mitm|-T\s+text|\bec_sleep\b|\bntlm_relay\b|\bRunFinger\.py\b/ ascii nocase
condition:
any of ($ettercap, $responder, $dnsspoof, $arppoison)
// 投毒手法名本身就是明确证据
any of ($art4, $art5)
or
$nmap and ($smb or $ms17 or $smbghost)
// 工具名 + 攻击参数
($tool1 and any of ($art1, $art2, $art3, $art6))
or ($tool2 and any of ($art1, $art2, $art3, $art6))
or ($tool3 and any of ($art1, $art2, $art3))
}

445
rules/pe.yar
View File

@@ -2,26 +2,34 @@
// MeshSafe L2B YARA 规则集 —— Windows PE 恶意程序专项（C1 + C8）
// =============================================================================
//
// 设计原则：
// - 所有规则使用 2-3 特征组合命中（API 组合 + C2 URL + Mutex 持久化等）
// - binary.py 的 PE 结构分析负责：节熵 + 签名 + 可疑导入（单 API）
// - YARA 负责：多 API 组合 + 字符串组合 + 壳 + 勒索专项
// - 命中后作为 finding 交给 PolicyEngine 权重累加，不直接零容忍
// 设计原则（v0.2.4 起，为消除干净软件误报而重写）：
// 1. 全文搜 API 名 = 必然误报。系统 DLL 会「导出」这些 API（kernel32 里就有
// VirtualAllocEx/WriteProcessMemory/CreateRemoteThread 的明文字符串），
// 安全 SDK、安装器、调试组件同理。因此 C1 系列一律要求：
// - 文件是 PE（uint16(0) == 0x5A4D），且
// - 相关 API 名出现在同一个窗口内（导入名表是连续的，窗口 256~512B）。
// 导出表按字母序排列、跨度通常上 KB，落在窗口外 → 不误报；
// 真注入器/下载器的导入名表三条名字通常挨在一起 → 命中。
// 2. 不单独用「API 组合」定性，必须有硬指标（可疑路径 / 持久化键名 / C2 URL）。
// 3. 不用 3~4 字母裸串（曾经的 $persist5 = "RUN"）和裸工具名。
// 4. binary.py 的 PE 结构分析负责节熵/签名/导入 API 分级；YARA 只做组合特征。
//
// 范围：
// - C1: Windows PE 恶意程序（注入器 / 下载器 / RAT / Loader）
// - C8: 勒索 / 挖矿专项
// - C9: 壳 / 签名 / 结构异常（binary.py 已覆盖大部分，YARA 补充壳特征）
// - C8: 勒索 / 挖矿专项（勒索样本常以文本/脚本形态投递，不加 PE 头判定）
// - C9: 壳特征（识别后建议送沙箱，不作为恶意证据）
//
// 维护：
// - 新恶意家族出现时，优先补充"API 组合 + Mutex 名 + C2 URL"三件套
// - 壳特征（UPX/Themida/VMP）可识别后自动送沙箱深检
// - 新增规则先跑「干净 PE 回归」：C:/Windows/System32 全量 900+ 文件必须 0 命中
// - meta.risk_level 会被 binary.py 读取用于严重度展示，必须与档位权重一致
// =============================================================================
import "pe"
// =============================================================================
// C1-1 进程注入三件套（VirtualAllocEx + WriteProcessMemory + CreateRemoteThread）
// binary.py 扫了 SuspiciousImports（单个 API），但 3 个同时出现 = 必然是注入器
// 判定要点：三个导入名必须在同一张导入名表里（512B 窗口），否则是导出表明文
// =============================================================================
rule C1_PE_ProcessInjection {
@@ -30,37 +38,66 @@ rule C1_PE_ProcessInjection {
category = "C1"
false_positive_rate = "low"
reference = "MITRE ATT&CK T1055 Process Injection"
description = "PE 文件同时导入 进程注入三件套 API = 远控/注入器特征"
description = "PE 导入表含进程注入三件套（同表紧邻）= 远控/注入器特征"
strings:
$s1 = "VirtualAllocEx" ascii
$s2 = "WriteProcessMemory" ascii
$s3 = "CreateRemoteThread" ascii
// 备选：Nt 系列（NtUnmapViewOfSection + VirtualAllocEx + CreateRemoteThread）
$n1 = "NtUnmapViewOfSection" ascii
$n2 = "NtMapViewOfSection" ascii
$n3 = "ZwUnmapViewOfSection" ascii
// 也可能是 QueueUserAPC 注 APC 注入
$alloc = "VirtualAllocEx" ascii
$write = "WriteProcessMemory" ascii
$thread = "CreateRemoteThread" ascii
// 进程镂空（Process Hollowing）
$unmap1 = "NtUnmapViewOfSection" ascii
$unmap2 = "ZwUnmapViewOfSection" ascii
// APC / Hook 注入
$apc = "QueueUserAPC" ascii
// 或 SetWindowsHookEx DLL 注入
$hook = "SetWindowsHookEx" ascii
$open = "OpenProcess" ascii
condition:
// 经典三件套（必须同时命中）
$s1 and $s2 and $s3
or
// Nt 系列内存注入（至少 2 个 Nt + 1 个注入）
(any of ($n1, $n2, $n3) and any of ($s1, $s3, $apc))
or
// APC 注入 + VirtualAllocEx
$apc and $s1
or
// Hook DLL 注入
$hook and $s1
uint16(0) == 0x5A4D
and
(
// 经典三件套：同表紧邻
(
$alloc and $write and $thread
and for any i in (1..#alloc): (
$write in (@alloc[i] - 512..@alloc[i] + 512)
and $thread in (@alloc[i] - 512..@alloc[i] + 512)
)
)
or
// 镂空注入：unmap 必须和 write+thread 同表（kernel32/shell32 只是从
// ntdll 导入成对的 NtMapView/NtUnmap，没有写入+远线程就不算镂空注入）
(
$write and $thread
and for any i in (1..#unmap1): (
$write in (@unmap1[i] - 512..@unmap1[i] + 512)
and $thread in (@unmap1[i] - 512..@unmap1[i] + 512)
)
)
or
(
$write and $thread
and for any i in (1..#unmap2): (
$write in (@unmap2[i] - 512..@unmap2[i] + 512)
and $thread in (@unmap2[i] - 512..@unmap2[i] + 512)
)
)
or
// APC / Hook 注入：目标进程 API + 注入 API 同表紧邻
(
$alloc and $open and ($apc or $hook)
and for any i in (1..#alloc): (
$open in (@alloc[i] - 512..@alloc[i] + 512)
and ($apc in (@alloc[i] - 512..@alloc[i] + 512)
or $hook in (@alloc[i] - 512..@alloc[i] + 512))
)
)
)
}
// =============================================================================
// C1-2 下载器组合（网络 API + 本地持久化 / 执行）
// 单一 URLDownloadToFile 不致命，但 "下载 + 执行 + 持久化" 三件套 = Loader
// C1-2 下载器 / Loader（下载 API + 落地持久化键名，且两者同表紧邻）
// v0.2.3 的写法：任意下载 API + "WriteFile" + "CreateProcess" + 裸串 "RUN"
// → 任何带自动更新的正常软件必中。现在要求持久化硬指标。
// =============================================================================
rule C1_PE_Downloader_Loader {
@@ -69,157 +106,172 @@ rule C1_PE_Downloader_Loader {
category = "C1"
false_positive_rate = "low"
reference = "MITRE ATT&CK T1105 Ingress Tool Transfer"
description = "下载器组合：HTTP/FTP 下载 + 写入到可疑路径 + 执行"
description = "下载 API 与自启动/服务注册持久化键名同表共存 = Loader"
strings:
// 网络下载 API（任选其一）
// 下载类 API（保留专有名词，不用裸串）
$net1 = "URLDownloadToFile" ascii
$net2 = "InternetOpenUrl" ascii
$net3 = "WinHttpOpen" ascii
$net4 = "WinHttpOpenRequest" ascii
$net5 = "FtpOpenFile" ascii
$net6 = "DownloadFile" ascii
$net7 = "WinHttpSendRequest" ascii
$net3 = "WinHttpOpenRequest" ascii
$net4 = "WinHttpSendRequest" ascii
$net5 = "URLDownloadToCacheFile" ascii
$net6 = "FtpOpenFile" ascii
$net7 = "WinHttpOpen" ascii
$net8 = "InternetOpen" ascii
// 写入/保存到本地
$save1 = "WriteFile" ascii
$save2 = "SaveToFile" ascii
$save3 = "URLDownloadToCacheFile" ascii
// 自启动 / 服务注册持久化硬指标（不是裸 "RUN"）
$p1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii nocase
$p2 = "CurrentVersion\\RunOnce" ascii nocase
$p3 = "schtasks.exe" ascii nocase
$p4 = "CreateService" ascii
$p5 = "Start Menu\\Programs\\StartUp" ascii nocase
$p6 = "reg add" ascii nocase
$p7 = "StartupApproved" ascii nocase
// 执行下载的载荷
$exec1 = "WinExec" ascii
$exec2 = "CreateProcess" ascii
$exec3 = "ShellExecute" ascii
$exec4 = "CreateRemoteThread" ascii
// 持久化（注册表/启动项）
$persist1 = "RegSetValueEx" ascii
$persist2 = "SetServiceObjectSecurity" ascii
$persist3 = "CreateService" ascii
$persist4 = "schtasks.exe" ascii
$persist5 = "RUN" ascii // HKCU\Software\Microsoft\Windows\CurrentVersion\Run
// 临时目录落地（Loader 常先落 %TEMP%）
$tmp1 = /\\AppData\\Local\\Temp\\[a-z0-9_. -]{3,60}\.(exe|dll|tmp|dat)/ ascii nocase
$tmp2 = /%TEMP%\\[a-z0-9_. -]{3,60}\.(exe|dll|tmp)/ ascii nocase
$tmp3 = /\\Windows\\Temp\\[a-z0-9_. -]{3,60}\.(exe|dll|tmp)/ ascii nocase
condition:
// 下载 + 保存 + 执行（三件套）
any of ($net*) and any of ($save*) and any of ($exec*)
or
// 下载 + 持久化（即使没执行也是准备投毒）
any of ($net*) and any of ($persist*)
or
// 执行 + 持久化（下载可能在运行时动态完成）
any of ($exec1, $exec2, $exec3) and any of ($persist*)
uint16(0) == 0x5A4D
and any of ($net*)
and any of ($p*)
and
(
// 下载 API 与持久化键名同处一个导入/字符串表块
for any i in (1..#net1): ( any of ($p*) in (@net1[i] - 1024..@net1[i] + 1024) )
or (any of ($tmp*) and 2 of ($p*))
)
}
// =============================================================================
// C1-3 RAT / 远控特征（C2 通信 + 命令执行 + 持久化）
// C1-3 RAT / 远控特征
// v0.2.3 的写法用 send( / recv( / system( 这类通用符号，且
// (bot|serv|gate|ops)\.(com|net) 会匹配任意域名字符串 → 正常联网程序必中。
// 现在要求：C2 硬指标（IP:PORT、可执行下载 URL、家族标记）+ 套接字 API 同表。
// =============================================================================
rule C1_PE_RAT_CommandControl {
meta:
risk_level = "critical"
category = "C1"
false_positive_rate = "medium"
false_positive_rate = "low"
reference = "MITRE ATT&CK T1071 Application Layer Protocol"
description = "RAT C2 通信特征：WinHTTP/WSASend + 命令执行 API + 可疑 URL/域名"
description = "RAT C2 特征：套接字 API + 明确 C2 指标（IP:端口 / .exe 下载 / 家族标记）"
strings:
// C2 网络通道
$c2_send = /WSASend|send\s*\(|sendto|WinHttpSendRequest|InternetWriteFile/ ascii
$c2_recv = /WSARecv|recv\s*\(|recvfrom|WinHttpReadData|InternetReadFile/ ascii
$c2_connect = /WSAConnect|connect\s*\(|WinHttpConnect|InternetConnect/ ascii
// 套接字 API（不用裸 send/recv/connect）
$sock1 = "WSASend" ascii
$sock2 = "WSARecv" ascii
$sock3 = "WSAConnect" ascii
$sock4 = "WSASocket" ascii
$sock5 = "inet_ntoa" ascii
$sock6 = "getpeername" ascii
// 命令执行
$cmd = /CreateProcess|ShellExecute|WinExec|system\s*\(|popen/ ascii
// 命令执行（真实 RAT 才会与 C2 同表出现）
$cmd1 = "CreateProcess" ascii
$cmd2 = "ShellExecute" ascii
$cmd3 = "WinExec" ascii
// 可疑 C2 URL（可执行文件里出现 http://...exe 或常见 C2 域名）
$c2url1 = /http:\/\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}:\d{2,5}/ ascii
$c2url2 = /https?:\/\/[^\"\s'\)]+\.(ru|top|xyz|tk|ml|ga|gq|cf|pw|click|stream|xyz|buzz|loan)\/[^\"\s'\)]*\.exe/ ascii
$c2url3 = /(c2|panel|gate|bot|ops|serv|beacon|stage|stager)\.(ru|top|xyz|cc|io|com|net)/ ascii
// C2 硬指标
$c2ip = /https?:\/\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}:[1-5][0-9]{3}/ ascii
$c2exe = /https?:\/\/[^\s"']{4,}\.(exe|dll|scr|vbs|ps1|bat)\b/ ascii nocase
$c2uri = /(gate|panel|submit|checkin|beacon|report)\.(php|aspx|html)\b/ ascii nocase
$c2tld = /\b[a-z0-9-]{4,30}\.(ru|top|xyz|tk|ml|ga|gq|cf|pw|buzz|loan)\b/ ascii nocase
condition:
// C2 通信 + 命令执行（至少两个网络 + 一个命令）
any of ($c2_send, $c2_recv, $c2_connect) and any of ($cmd*) and any of ($c2url*)
or
// C2 URL 模式 + 网络 API
any of ($c2url*) and any of ($c2_connect, $c2_send)
uint16(0) == 0x5A4D
and 2 of ($sock*)
and any of ($c2*)
and
(
any of ($cmd*)
or $c2exe
or $c2uri
)
}
// =============================================================================
// C1-4 Mutex 互斥体名（勒索 / RAT / Loader 的持久化标记）
// 单一 Mutex 名有一定价值，但必须配合其他特征才触发
// 需要 CreateMutex 与家族 Mutex 名同表，避免文本文档里提一嘴家族名就命中
// =============================================================================
rule C1_PE_Mutex_Persistence {
meta:
risk_level = "medium"
category = "C1"
false_positive_rate = "medium"
false_positive_rate = "low"
reference = "MITRE ATT&CK T1057 Process Discovery (mutex as persistence marker)"
description = "可疑 Mutex 名称 + CreateMutex API = 持久化标记"
description = "CreateMutex + 已知家族 Mutex 名同表 = 持久化标记"
strings:
$createmutex = "CreateMutexA" ascii
$createmutexw = "CreateMutexW" ascii
// 常见勒索/RAT Mutex 名（大小写不敏感，含 Unicode 变体用 wide）
// LockBit
$lockbit1 = /Global\\[Ll]ock[Bb]it/ ascii
$lockbit2 = /Local\\[Ll]ock[Bb]it/ ascii
// BlackCat / ALPHV
$blackcat = /Global\\[Bb]lack[Cc]at|[Aa][Ll][Pp][Hh][Vv]/ ascii
$blackcat = /(Global|Local)\\[Bb]lack[Cc]at|\bALPHV\b/ ascii
// Ryuk
$ryuk = /RyukTask[\d]|Global\\Ryuk/ ascii
// Conti
$conti = /Global\\[Cc]onti|Local\\[Cc]onti/ ascii
$conti = /(Global|Local)\\[Cc]onti/ ascii
// Pseudo/Dharma
$dharma = /Global\\[Dd]harma|Local\\[Dd]harma/ ascii
// 通用可疑模式：Mutex 名包含 "Mutex" + UUID 变体
$dharma = /(Global|Local)\\[Dd]harma/ ascii
// 通用可疑模式：Mutex 名含 UUID 前缀
$generic1 = /Global\\Mutex[0-9a-f]{8}/ ascii
// Kryptik/Qakbot
$qakbot = /[Qq]akbot|[Kk]ryptik/ ascii
$qakbot = /\b[Qq]akbot\b|\b[Kk]ryptik\b/ ascii
// Cobalt Strike named pipe
$cs1 = /\\\\\.\\pipe\\msagent_[0-9a-f]+/ ascii
$cs2 = /\\\\\.\\pipe\\[Bb]eacon_[0-9a-f]+/ ascii
condition:
// CreateMutex + 已知家族 Mutex 名
(any of ($createmutex*)) and any of ($lockbit1, $lockbit2, $blackcat, $ryuk, $conti, $dharma, $qakbot)
or
// Cobalt Strike 命名管道特征（不需要 CreateMutex）
any of ($cs*)
or
// CreateMutex + 通用可疑 UUID Mutex
(any of ($createmutex*)) and $generic1
uint16(0) == 0x5A4D
and
(
any of ($cs*)
or (
any of ($createmutex*)
and any of ($lockbit1, $lockbit2, $blackcat, $ryuk, $conti, $dharma, $qakbot, $generic1)
)
)
}
// =============================================================================
// C1-5 DLL 劫持 / LoadLibrary 动态加载
// C1-5 DLL 劫持 / 侧加载
// 只看「LoadLibrary + GetProcAddress + 临时目录里的 DLL 名」三件套；
// \ProgramData\ 与 \Public\ 是正常安装器路径，不再单独作为可疑路径
// =============================================================================
rule C1_PE_DLLHijacking {
meta:
risk_level = "high"
category = "C1"
false_positive_rate = "medium"
false_positive_rate = "low"
reference = "MITRE ATT&CK T1574 Hijack Execution Flow"
description = "PE 动态加载多个系统 DLL + 非系统路径 = DLL 劫持迹象"
description = "动态加载 API + 临时目录 DLL 落地 = DLL 侧加载/劫持"
strings:
$loadlib = "LoadLibraryA" ascii
$loadlibw = "LoadLibraryW" ascii
$getproc = "GetProcAddress" ascii
// 可疑加载路径（非 System32）
$path1 = /\\Users\\[^\\]+\\AppData\\Local\\Temp/ ascii
$path2 = /\\AppData\\Local\\Temp/ ascii
$path3 = /\\ProgramData\\/ ascii
$path4 = /\\Public\\Documents\\/ ascii
$copy1 = "CopyFileA" ascii
$copy2 = "CopyFileW" ascii
$move = "MoveFileEx" ascii
$temp1 = /\\AppData\\Local\\Temp\\[a-z0-9_. -]{3,40}\.dll/ ascii nocase
$temp2 = /%TEMP%\\[a-z0-9_. -]{3,40}\.dll/ ascii nocase
$temp3 = /\\Windows\\Temp\\[a-z0-9_. -]{3,40}\.dll/ ascii nocase
$sysdir = "SetDllDirectory" ascii
$searchorder = "LoadLibraryEx" ascii
condition:
// LoadLibrary + 可疑路径 + GetProcAddress = 完整劫持链
(any of ($loadlib*)) and any of ($path*) and $getproc
or
// LoadLibrary + 多个可疑路径
(any of ($loadlib*)) and 2 of ($path*)
uint16(0) == 0x5A4D
and any of ($loadlib*, $searchorder)
and any of ($temp*)
and (any of ($getproc, $copy1, $copy2, $move, $sysdir))
}
// =============================================================================
// C1-6 LOLBin（Living Off The Land Binary）调用特征
// 已知合法 Windows 二进制被恶意利用来执行命令
// 命令行串 + 进程创建 API 必须同表紧邻（正常程序会把两者写进同一个导入/资源块）
// =============================================================================
rule C1_PE_LOLBin_Usage {
@@ -228,31 +280,57 @@ rule C1_PE_LOLBin_Usage {
category = "C1"
false_positive_rate = "low"
reference = "https://lolbas-project.github.io/"
description = "PE 文件中出现 LOLBin 调用：certutil / mshta / rundll32 / regsvr32 / bitsadmin / wmic / msiexec"
description = "PE 中出现 LOLBin 调用命令行 + 进程创建 API（同表）"
strings:
$certutil = /certutil(\.exe)?\s+(-urlcache|-decode|-encode|-hashfile)/ ascii
$mshta = /mshta(\.exe)?\s+(https?:|javascript:|vbscript:)/ ascii
$rundll32 = /rundll32(\.exe)?\s+[A-Za-z0-9_.]+,/ ascii
$regsvr32 = /regsvr32(\.exe)?\s+\/s\s+\/u/ ascii
$bitsadmin = /bitsadmin(\.exe)?\s+(\/transfer|\/create)/ ascii
$wmic = /wmic(\.exe)?\s+(process\s+call\s+create|product\s+call)/ ascii
$msiexec = /msiexec(\.exe)?\s+\/[ia]\s+https?:/ ascii
$installutil = /installutil(\.exe)?\s+\/u\s+\/logfile=/ ascii
$syncapp = /syncapp(\.exe)?\s+\/compattrack/ ascii
$psexec = /psexec(\.exe)?\s+(-accepteula|-i\s+\d+|-w\s+https?:)/ ascii
// 命令执行 API（用于组合条件）
$lolbin1 = /certutil(\.exe)?\s+(-urlcache|-decode)\s+-split/ ascii nocase
$lolbin2 = /mshta(\.exe)?\s+(https?:|javascript:|vbscript:)/ ascii nocase
$lolbin3 = /regsvr32(\.exe)?\s+\/s\s+\/u:http/ ascii nocase
$lolbin4 = /bitsadmin(\.exe)?\s+\/transfer\s+\/source:/ ascii nocase
$lolbin5 = /wmic(\.exe)?\s+process\s+call\s+create/ ascii nocase
$lolbin6 = /msiexec(\.exe)?\s+\/[ia]\s+https?:/ ascii nocase
$lolbin7 = /installutil(\.exe)?\s+\/u\s+\/logfile=https?:/ ascii nocase
$lolbin8 = /psexec(\.exe)?\s+(-accepteula\s+)?-w\s+https?:/ ascii nocase
$exec1 = "CreateProcess" ascii
$exec2 = "ShellExecute" ascii
$exec3 = "WinExec" ascii
condition:
// 至少 1 个 LOLBin 调用 + 命令执行 API
any of ($certutil*, $mshta*, $rundll32*, $regsvr32*, $bitsadmin*, $wmic*, $msiexec*, $installutil*, $syncapp*, $psexec*)
uint16(0) == 0x5A4D
and any of ($lolbin*)
and any of ($exec*)
}
// =============================================================================
// C8-1 勒索加密 API 组合（CryptEncrypt + BCrypt* + 文件遍历 + 删除卷影）
// C1-7 PE 高熵 + 网络 API（疑似加壳下载器）
// 需要「多个网络 API + 明确壳节名」同时成立
// =============================================================================
rule C1_PE_EntropyHighNetwork {
meta:
risk_level = "medium"
category = "C1"
false_positive_rate = "low"
reference = "binary.py HighEntropySection 联动"
description = "PE 加壳节名 + 多个下载 API = 加壳下载器"
strings:
$net1 = "InternetOpenUrl" ascii
$net2 = "URLDownloadToFile" ascii
$net3 = "WinHttpOpenRequest" ascii
$net4 = "WSAConnect" ascii
condition:
uint16(0) == 0x5A4D
and 2 of ($net*)
and (
for any i in (0..pe.number_of_sections - 1): (
pe.sections[i].name matches /UPX0/ or pe.sections[i].name == "UPX1"
or pe.sections[i].name matches /\.vmp[0-9]/ or pe.sections[i].name matches /Themida|\.themida/
)
)
}
// =============================================================================
// C8-1 勒索加密链（加密 API + 卷影删除/勒索信，勒索样本常以文本形态投递，不加 PE 头）
// =============================================================================
rule C8_Ransomware_Encryption {
@@ -261,9 +339,9 @@ rule C8_Ransomware_Encryption {
category = "C8"
false_positive_rate = "low"
reference = "MITRE ATT&CK T1486 Data Encrypted for Impact"
description = "勒索加密链：CryptEncrypt/BCryptEncrypt + 大量文件遍历 + 卷影删除 = 勒索"
description = "勒索加密链：加密 API + 卷影删除命令或勒索信文件名"
strings:
// 加密 API（至少出现两个）
// 加密 API
$enc1 = "CryptEncrypt" ascii
$enc2 = "CryptDeriveKey" ascii
$enc3 = "BCryptEncrypt" ascii
@@ -276,25 +354,23 @@ rule C8_Ransomware_Encryption {
$enum3 = "FindNextFileA" ascii
$enum4 = "FindNextFileW" ascii
// 卷影删除（勒索前置）
$vss1 = "vssadmin" ascii
$vss2 = "delete shadows" ascii
// 卷影删除（完整命令，不认裸 "wmic"）
$vss1 = "vssadmin" ascii nocase
$vss2 = "delete shadows" ascii nocase
$vss3 = "DeleteShadowCopies" ascii
$vss4 = "wmic" ascii
$vss4 = "shadow copies" ascii nocase
// 勒索信文件名变体（出现在二进制里）
$ransomnote1 = /(HOW_TO_RECOVER|RESTORE_FILES|DECRYPT_INSTRUCTIONS|README|HELP_DECRYPT|_readme|_restore)[\w.-]*\.(txt|html|png|jpg|bmp|url)/ nocase
$ransomnote2 = /\.(locky|zepto|cryptolocker|tor|crpt|encrypted|virus|wallet|pay2)/ nocase
$ransomnote3 = /bitcoin|bitcash|monero|ltc|BTC\b/ ascii
// 勒索信文件名 / 加密扩展名
$note1 = /(HOW_TO_RECOVER|RESTORE_FILES|DECRYPT_INSTRUCTIONS|HELP_DECRYPT)[\w.-]*\.(txt|html|png|jpg|bmp|url)/ nocase
$note2 = /\.(locky|zepto|cryptolocker|crpt|encrypted|pay2)\b/ nocase
condition:
// 加密 API + 文件遍历 = 加密工具（必须至少 2 个加密 API）
(2 of ($enc*)) and any of ($enum*)
or
// 加密 API + 卷影删除 = 完整勒索
(any of ($enc*)) and any of ($vss*)
or
// 加密 API + 勒索信 + 加密文件扩展名 = 明确勒索
(any of ($enc*)) and (any of ($ransomnote1, $ransomnote2)) and $ransomnote3
any of ($enc*)
and
(
($vss1 and ($vss2 or $vss3 or $vss4))
or (2 of ($enum*) and any of ($note*))
or (2 of ($enc*) and any of ($enum*) and $vss1)
)
}
@@ -310,53 +386,51 @@ rule C8_Mining_Monero {
reference = "MITRE ATT&CK T1496 Resource Hijacking"
description = "挖矿程序特征：xmrig 命令行参数 / stratum+tcp / 矿池域名"
strings:
// xmrig 命令行特征
$xmrig1 = "xmrig" ascii nocase
$xmrig2 = /--donate-level\s+\d+/ ascii
$xmrig3 = /-o\s+stratum\+tcp/ ascii
$xmrig4 = /--cpu-priority\s+\d/ ascii
$xmrig5 = /--max-threads-hint/ ascii
// 矿池域名（Monero）
$pool1 = "pool.xmrig.com" ascii nocase
$pool2 = "pool.minexmr.com" ascii nocase
$pool3 = "pool.supportxmr.com" ascii nocase
$pool4 = "mine.moneropool.com" ascii nocase
$pool5 = "stratum+tcp://" ascii
// CPU 高占用循环特征
$loop = /(while|for)\s*\(\s*\d+\s*[<>=]/ ascii
$thread = "CreateThread" ascii
condition:
// 至少 2 个 xmrig 特征
(any of ($xmrig1, $xmrig2, $xmrig3, $xmrig4, $xmrig5)) and 2 of ($*)
or
// stratum+tcp 矿池协议 + 多个线程创建
$pool5 and ($thread or 2 of ($xmrig*))
any of ($pool1, $pool2, $pool3, $pool4)
or ($pool5 and (any of ($xmrig*) or $thread))
or (2 of ($xmrig*) and any of ($pool*))
}
// =============================================================================
// C9 壳特征（UPX / Themida / VMProtect / Enigma）
// 壳识别后建议升级到 L3 沙箱深检，不单独阻断
// C9 壳特征（UPX / Themida / VMProtect）
// 加壳本身不是恶意证据（大量开源工具用 UPX），只作沙箱深检触发条件
// =============================================================================
rule C9_Packer_UPX {
meta:
risk_level = "medium"
risk_level = "low"
category = "C9"
false_positive_rate = "low"
reference = "UPX Packer"
description = "UPX 加壳 PE：节名 UPX0 / UPX1 + UPX 签名"
description = "UPX 加壳 PE：节名 UPX0/UPX1 + UPX 签名"
strings:
$upx0 = "UPX0" ascii
$upx1 = "UPX1" ascii
$upx2 = "UPX!" ascii
$upx3 = /UPX\s+\d+\.\d+/ ascii // "UPX 3.96" 这类版本字符串
$upx4 = /UPX\b/ ascii
condition:
// 节名（两个）+ 签名
($upx0 and $upx1) or ($upx2 and any of ($upx3, $upx4))
uint16(0) == 0x5A4D
and (
(
for any i in (0..pe.number_of_sections - 1): (
pe.sections[i].name matches /UPX0/
)
and for any j in (0..pe.number_of_sections - 1): (
pe.sections[j].name matches /UPX1/
)
)
or ($upx2 and pe.number_of_sections <= 4)
)
}
rule C9_Packer_Themida_VMP {
@@ -365,39 +439,18 @@ rule C9_Packer_Themida_VMP {
category = "C9"
false_positive_rate = "low"
reference = "Themida / VMProtect"
description = "商业壳特征：Themida / VMProtect 产品标识字符串"
description = "商业壳特征：Themida / VMProtect 节名 + 产品标识字符串"
strings:
$themida1 = "Themida" ascii wide
$themida2 = "WinLicense" ascii wide
$themida3 = "Oreans" ascii wide
$vmp1 = "VMProtect" ascii wide
$vmp3 = "VMProtect SDK" ascii wide
condition:
any of ($themida*) or any of ($vmp*)
}
// =============================================================================
// C1-7 PE 高熵 + 大量网络 API（疑似加壳下载器）
// binary.py 的 HighEntropySection 已单独扫描，但 YARA 看"熵 + 网络"组合
// =============================================================================
rule C1_PE_EntropyHighNetwork {
meta:
risk_level = "medium"
category = "C1"
false_positive_rate = "medium"
reference = "binary.py HighEntropySection 联动"
description = "PE 同时出现：多个网络 API + 加壳特征（熵高） + 无签名"
strings:
$net1 = "InternetOpenUrl" ascii
$net2 = "WinHttpOpen" ascii
$net3 = "URLDownloadToFile" ascii
$net4 = "WSAConnect" ascii
// 壳特征
$upx = "UPX0" ascii
$themida = "Themida" ascii
condition:
// 网络 API + 壳特征 = 加壳下载器
any of ($net*) and ($upx or $themida)
uint16(0) == 0x5A4D
and (
for any i in (0..pe.number_of_sections - 1): (
pe.sections[i].name matches /\.themida|\.vmp[0-9]/
)
or (any of ($themida*) and any of ($vmp1))
)
}

45
rules/ransom.yar
View File

@@ -126,26 +126,41 @@ rule C8_Ransomware_Note_Filename {
meta:
risk_level = "medium"
category = "C8"
false_positive_rate = "medium"
false_positive_rate = "low"
reference = "勒索信文件名通用模式"
description = "勒索信典型文件名变体（匹配后触发需要配合加密 API 才升级高危）"
description = "勒索信文件名 + （加密 API + 赎金语言）或（赎金语言 + 钱包地址）"
strings:
// 只保留"文件名形态"的勒索信特征：家族专有名 + 扩展名。
// 不再用裸 README.txt / _readme.txt：任何安装包都带这两个字面量，
// 在二进制内容上做全文匹配时必然命中（Go 官方 MSI 即被这样判成恶意）。
$n1 = /HOW_TO_RECOVER[\w.-]*\.(txt|html|png|bmp|jpg|url|vbs|js)/ nocase
$n2 = /RESTORE_FILES[\w.-]*\.(txt|html|png|bmp|jpg|url|vbs|js)/ nocase
$n3 = /DECRYPT_INSTRUCTIONS[\w.-]*\.(txt|html|png|bmp|jpg|url)/ nocase
$n4 = /README[_\s-]*[\d]*[_\s-]*[\w]*\.(txt|html|png|bmp|jpg|url)/ nocase
$n4 = /README[._-]*(FOR[._-]*DECRYPT|TO[._-]*RESTORE)[\w.-]*\.(txt|html|png|bmp|jpg|url)/ nocase
$n5 = /HELP_DECRYPT[\w.-]*\.(txt|html|png|bmp|jpg|url)/ nocase
$n6 = /_readme[\w.-]*\.(txt|html|png|bmp|jpg|url)/ nocase
$n7 = /_restore[\w.-]*\.(txt|html|png|bmp|jpg|url)/ nocase
$bitcoin = /bitcoin address|BTC\b|monero address|XMR\b|send money|ransom|payment/ nocase
$wallet = /1[A-Za-z0-9]{25,34}|bc1[A-Za-z0-9]{11,71}|4[0-9A-Za-z]{32}/ nocase
$n6 = /\b_(readme|restore)[\w.-]*\.(txt|html|png|bmp|jpg|url)/ nocase
$n7 = /(how_to_decrypt|restore_my_files|decrypt_your_files)[\w.-]*\.(txt|html)/ nocase
// 赎金语言：必须是完整词组。裸 "BTC"/"XMR"/"payment"/"ransom" 在压缩流里
// 会以随机字节出现，"ransom" 还会被 "Ransomware" 子串命中。
$payment = /(bitcoin|monero|xmr|btc)\s+(address|wallet)|send\s+(the\s+)?money|pay\s+(the\s+)?(ransom|fee)|\bransom\b\s+(note|payment|demand)|your\s+files\s+(are\s+)?encrypted|decrypt\s+your\s+files/ nocase
// 钱包地址：锚定到整个 token，并用真实地址字符集/长度。
// 原写法 1[A-Za-z0-9]{25,34} 无边界，单个 56MB 安装包命中 7.6 万次。
$btc_addr = /\b[13][a-km-zA-HJ-NP-Z1-9]{25,34}\b/
$bech32 = /\bbc1q[a-z0-9]{38}\b|\bbc1q[a-z0-9]{58}\b/
$xmr_addr = /\b[48][0-9A-Za-z]{94}\b/
$encapi = /CryptEncrypt|BCryptEncrypt|CryptDeriveKey/ ascii
condition:
// 勒索信文件名 + 加密 API = 明确勒索
any of ($n*) and $encapi
or
// 勒索信文件名 + 比特币/XMR 地址 = 大概率勒索
any of ($n*) and any of ($bitcoin, $wallet)
any of ($n*)
and (
// 投递器：真加密 API + 赎金语言
($encapi and $payment)
or
// 纯文本勒索信：赎金语言 + 具体钱包地址
($payment and any of ($btc_addr, $bech32, $xmr_addr))
)
}
@@ -199,11 +214,13 @@ rule C8_Ransomware_VolumeShadow {
$vss2 = /vssadmin\s+delete\s+shadows\s+\/all\b/ ascii
$wmic1 = /wmic\s+shadowcopy\s+delete/ ascii
$wmic2 = /wmic\s+shadowcopy\s+where\s+\d+/ ascii
$vss3 = /ShadowCopy|VolumeShadowCopy|vss\b/i ascii // "i" flag = nocase in YARA
$vss4 = /vssadmin[^\n]{0,48}delete[^\n]{0,48}(shadows|shadow\s+copies)/ ascii
$enc = /CryptEncrypt|BCryptEncrypt|CryptDeriveKey/ ascii
condition:
// 卷影删除 + 加密 API = 完整勒索前置
(any of ($vss1, $vss2, $wmic*, $vss3)) and any of ($enc*)
// 不用裸 "vss"/"ShadowCopy" 子串：任何备份/卷影库的符号表都有它们，
// 和 CryptEncrypt 同框就报勒索，是典型误报来源。
(any of ($vss1, $vss2, $wmic*, $vss4)) and any of ($enc*)
or
// 连续多次 vssadmin delete = 正在清卷影
any of ($vss1, $vss2) and any of ($wmic*)

17
rules/webshell.yar
View File

@@ -57,12 +57,19 @@ rule C3_PHP_Webshell_Obfuscated {
$rot13 = "str_rot13" ascii wide
$assert = "assert(" ascii wide
$createfn = "create_function" ascii wide
// PHP 上下文证据：没有 <?php / 超全局变量，就不要凭函数名定罪（vim、git 等
// 二进制里同样存在 base64_decode / eval( 字样）
$php1 = "<?php" ascii
$php2 = /\$_(GET|POST|REQUEST|COOKIE|FILES|SESSION)\b/ ascii
condition:
// base64_decode + (eval|assert|create_function) = 解码后动态执行
$b64 and ($eval or $assert or $createfn)
or
// 解码链：base64 + gzinflate / str_rot13 + 执行
$b64 and ($gzinflate or $rot13) and ($eval or $assert)
any of ($php*)
and (
// base64_decode + (eval|assert|create_function) = 解码后动态执行
($b64 and ($eval or $assert or $createfn))
or
// 解码链：base64 + gzinflate / str_rot13 + 执行
($b64 and ($gzinflate or $rot13) and ($eval or $assert))
)
}
// PHP Webshell —— 变量变形（$$a = $_POST['cmd']；$$a($_POST['arg'])）

6
scripts/migrate.sql
View File

@@ -1,3 +1,9 @@
-- 修复 real_type 字段长度：VARCHAR(128) → VARCHAR(256)
-- libmagic 对 ZIP/ISO 等返回的描述可能超过 128 字符
ALTER TABLE scan_tasks ALTER COLUMN real_type TYPE VARCHAR(256);
-- 修复 real_type 字段长度：VARCHAR(256) → VARCHAR(512)
-- libmagic 对 MSI/OLE 复合文档会把 Title/Subject/Author/Creating Application 等元数据
-- 全部拼进描述串（实测 go1.25.0.windows-amd64.msi 超过 334 字符），超出列宽会让
-- 整条 scan_tasks INSERT 失败，连带的 scan_findings 一起丢失——被拒绝的文件反而不留痕。
ALTER TABLE scan_tasks ALTER COLUMN real_type TYPE VARCHAR(512);